Posted
by
timothy
on Thursday October 03, 2013 @08:26AM
from the c'mon-fellas-it's-for-the-greater-good dept.

jest3r writes "Lavabit won a victory in court and were able to get the secret court order [which led to the site's closure] unsealed. The ACLU's Chris Soghoian called it the nuclear option: The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested. Lavabit could either comply or shut down. As such, no U.S. company that relies on SSL encryption can be trusted with sensitive data. Everything from Google to Facebook to Skype to your bank account is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone."

Your favorite site also bans random TOR exit nodes from browsing it. I can understand banning posting to prevent spam and such, but browsing ? That's just moronic. It also craps when the IP of the user changes during editing/posting.

Slashdot, please get on with the times, you are probably the legal site most visited by TOR users. You need to add HTTPS and improve TOR support.

If it is encrypted they can't see what page you are browsing, or trivially associate your IP address/subscriber details with your Slashdot UID. Of course they could do all that stuff with some effort anyway, but we need to make it as hard and computationally intensive as possible. That's one of the best ways to thwart mass surveillance.

Never ask "why do you want privacy"; that's always a stupid question. Privacy is simply an integral part of the two prime human goals: liberty and dignity.

This is a fundamental mindset change that's needed in developers! We've learned to write software that uses the least possible privilege, as the core of security. We need to learn to write software that offers the most possible privacy, as the core of human rights.

And if you get one of these national security letters or other absurd warrant from the feds, publish it. The right of the press to publish otherwise classified material was affirmed in the 1971 case New York Times Co. v. United States, although that was a pretty weak ruling. But unless you've agreed to keep something secret, you're theoretically free to do with it as you like. Also, I'm not a lawyer and you shouldn't take your legal advice from the internet.

Yes, the U.S. has the equivalent to parliamentary privilege, and it's been used in living memory rather famously. During the Vietnam War era, Mike Gravel, a Senator from Alaska, included the Pentagon Papers [wikipedia.org] into the Congressional Record, meaning they were then publicly available. He was protected by Article I, Section 6 of the Constitution, which among other things says about members of Congress that "for any Speech or Debate in either House, they shall not be questioned in any other Place." ("Speech" includes inclusions into the Congressional Record.)

Understandable that he shut down.The USA is ruled by evil bastards that have no respect for the citizens.Time to revolt is now.

It's basically your fault there will be no revolution because you decided not to put an exclamation point which, very appropriately,sums up the attitude of most Americans about anything other than sports, shitty beer and big tits.

Or, if you aren't willing to do that, because revolutions are messy and often as not end up worse than what you had, kindly shut the fuck up.

I will not be joining you because while I feel the US has not been moving in a positive direction as of late, I feel that the solution to fixing it involves using the democratic process, not violent revolution, since I understand how nasty those are and also have a perspective on how good the US has it overall.

I get really tired of whiny, usually anonymous, basement dwellers playing toughguy on the net, decrying the US and saying we need to "revolt" or "rise up" or some BS. You aren't going to do that and you know it. So you are just being a douchebag, whining and complaining, suggesting that others should do the dirty work.

So put up or shut up. If revolution is really what you think is needed, get on that then. Though you might want to research a little as to what often happens to revolutionaries, and to countries after. If you don't, then STFU about it. Less whine, more action.

In fact, you will probably find that if you and other like you spent less time whining and more time working to affect actual change in the country within the system we have, things might start getting better.

the US gets the press, but every country is doing as much as they can (and are able to) with the money and network taps they have in place.

this is human nature. the dark side of human nature.

at least its out in the open, now. what we do with it, as a species, is up to us. do we put our data thieves (ie, the government) behind bars or do we just say 'I have nothing to hide!' and let them continue along with their abuse and theft of our privacy?

there is no country that won't do this, no matter what they say. so stop thinking its the big bad old USA. its everyone, everywhere, who CAN do it. companies includes (your corp firewall and your corp provided laptop probably has built-in certs from the company)

there is no country that won't do this, no matter what they say. so stop thinking its the big bad old USA. its everyone, everywhere, who CAN do it.

Qualitatively, yes you're probably right. Quantitatively, not so much. It's like the military. Every country, or almost, has one. But only the USofA spends about as much on "defense" as the rest of the planet put together.

PS Capitals, used with some restraint, go a long way to making heads and tails out of a sentence.

the US gets the press, but every country is doing as much as they can (and are able to) with the money and network taps they have in place.

I live in Ireland. I can pretty much guarantee you of three things.

1) The state lacks the expertise to snoop on any communications.2) The state lacks the legal clout to force anyone to turn over their encryption keys.3) The government would likely not survive the closure of an IT SME such as Lavabit -- and loss of associated jobs -- which resulted from direct government interference in that company's ability to operate in Ireland.

The rules that apply to the US government do not apply to every government. Some governments lack the skills, laws, and nerve to pull off what the White House/NSA is doing to US internet companies right now. More governments simply lack the money to pay for so extensive a network of surveillance and control.

there is no country that won't do this, no matter what they say. so stop thinking its the big bad old USA. its everyone, everywhere, who CAN do it.

That can includes more than simply being ABLE to do it. It includes being EMPOWERED to do it, being PERMITTED by the people to do it, and to being able to AFFORD to do it. Right now the US government is able, empowered, but only just about permitted and certainly not able to afford to continue to finance a spying program of this magnitude.

The Soviet Union exhausted both its finances and legitimacy in trying to keep its populace under control. Hopefully the US will not have to go through as painful a breakup in order to reverse its present trend.

I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?

I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?

Because presumably the whole point of Lavabit is that the stored email was encrypted based on a key that only the user had, so in-transit is the only place they could see it.

The FBI originally wanted access to just Snowden's account and Lavabit refused. In order to get it, they demanded SSL keys to feed into their snoop machine so they could filter out just Snowden's info.

At that point, Lavabit AGREED to provide a tap on just Snowden. The FBI basically said "too late, we don't trust you to do it properly".

Not that they should get what they tried to -- the SSL private keys -- but the summary makes it out to be something different than what happened.

Why would they want to intercept the traffic when they could just read it off the server?

from TFA:....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.

The message contents, yes. But the header information they did have access to, as it's necessary for delivery. And that information is what the FBI wanted, and that information is what was all protected by a single SSL cert.

Actually, they did not have access to the site (that would have been overly broad and unconstitutional), but lavabit was forced by the court to install a packet dumper. So FBI had the full encrypted streams of all user sessions. FBI then requested the SSL key that would unlock all stored streams. The court reasoned that because the site uses a single SSL key for all users, that's lavabit's fault and agreed that the request is not overly broad.

Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange. The encryption key is ephemeral and the SSL private key cannot be used to perform a passive attack on the sniffed. FBI/NSA is forced to perform a MIM on the very sessions they target; if done on the scale of the whole internet, this would be easily detected.

PFS would not help in this case. The FBI asserted that a pen register (which is not a warrant and merely requires the government to assert "relevance") is sufficient to obtain the SSL keys for an entire service, because they choose to implement it via an SSL interceptor. LavaBit argued the pen register does not grant such broad power, so then they went and got a search warrant for it instead.

Obviously if the FBI has the SSL key, they can impersonate LavaBit and intercept everything at that point. It helps o

The best part is they said here that they wanted the "Root Certificate", which would allow them to sign new keys. Caveat: that's just a trust model, allowing them to replace LavaBit's SSL key. What they wanted was LavaBit's site SSL private key.

Let's say that the NSA got the Verisign Root Certificate and started using it to sign Verisign CSRs. A CSR includes the public key (certificate), but not the private key. The public key is already known. The NSA gains... nothing.

Now if they get the Google Gmail SSL private key, they can decrypt the SSL session handshake and key exchange. The key exchange exchanges a symmetric encryption key for AES or RC4 (yes RC4 is secure; yes I know it's used in WEP, which uses a new NONCE for every packet, and in their implementation they generate insecure NONCE/IV pairs and you can collect millions of these and crack it. Not applicable here). With Gmail's SSL private key, the NSA can decrypt the symmetric session key exchange and use that key to decrypt your session and read your e-mail.

You need the Certificate Patrol [mozilla.org] plugin, which warns you when a site's certificate changes unexpectedly, even when the new certificate has a "valid" signature.

Unfortunately, this doesn't work with Google's servers, who rotate among a gazillion certificates "legitimately", and thus drown the user in false positives. But given Google's cooperation with Prism, maybe this effect is wanted?

Firstly they wanted *all* meta data on every Lavabit user, not just Snowden. It was a blanket demand to get all of the data.They also wanted man-in-the-middle box. A device which would have the root certificate under control of the government and would sit in Lavabits network able to man-in-the-middle attack emails (i.e. speech) of Lavabit users not connected to Snowden.

Lavabit are guardians of the customers data, how can they guard if a black-box is on their network? It can do anything, the judge has no way of telling, Lavabit has no way of telling. Google apparently refused these boxes and with good reason. There is no trust here, the Judge is not supposed to trust the FBI & NSA to do only what it says. He's supposed to be the guardian of the law, just as Lavabit are the guardians of the data.

An example, if I had such a box, I could spoof email convincingly in a way that would pass forensics. I could create fake evidence. I could spread disinformation (propaganda) again untraceably.

They also asserted that it filters out only the data they were allowed to have and throws away the rest. We know this has been proven to be false in many many leaks, even the President now pretends the data goes into a 'lockbox'. A lockbox isn't a lockbox if the NSA has the key and no judicial oversight stops them turning that key at will.

It seems, once again, the judicial branch has simply become a fawning sidekick to the executive branch.

Well, I read the court documents and it appears the sequence of events went something like:

1. FBI asked for real time details of (Snowden? Everyone thinks Snowden, the request was one day after it was revealed he has an account with Lavabit) an account, specifically metadata relating to email exchanges.

2. Lavabit didn't respond.

3. FBI got pissed, involved courts

4. Lavabit made an offer to provide the information on a monthly basis, rather than a realtime basis, and asked for payment of $3,500 ($2,000 for labor and I can't remember what the other $1,500 was.)

5. FBI threw a fit, announced that instead they were now asking for a box to be installed to intercept communications. The box would be programmed to only transmit the required information about person-we-think-is-Snowden, but because of the way it's designed would require Lavabit's SSL keys.

5. Lavabit: Nu-uh.

6. Courts: Uh yeah, we're siding with the FBI on this one.

7. "But I don't trust the government to only intercept $PROBABLY_SNOWDEN's records. Also I want to talk about this case, first amendment and whatnot."

8. Courts: "Well the government doesn't trust you, has good reason not to trust you based on your history of non-cooperation, and I don't care whether you trust it, established precedent says you have to cooperate. Also I'm not going to let you tell anyone about anything so there."

At this point the courts started threatening fines. Lavabit gave up its key but in a way designed to piss off the FBI, which, of course, pissed off the court too. Court started imposing fines. Lavabit shut itself down.

My reading:

1. Lavabit wasn't as principled as claimed by Glenn Greenwald et al. They did actually plan (or told the courts and the FBI they would anyway) to release the records relating to $PROBABLY_SNOWDEN to the FBI. At best you can argue they were lying, but how's that showing integrity?

2. Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing. These mistakes made it easy for the FBI to argue that they couldn't trust Lavabit to do what Lavabit was offering to do. Lavabit should have contacted the FBI immediately, made it clear their concerns, and not made a clearly bad-faith offer to provide something useless to the FBI - I don't mean they should have offered something useful, they should have said instead "Look, this is a major problem for us, we have to investigate further and determine something that can satisfy the law and your requirements that does not damage the integrity of our system", and had a lawyer work with the courts on this.
3. Notwithstanding the above, the court's refusal to allow Lavabit to talk to politicians et al about the basic principles in the case seems absurd and completely unconstitutional. Given the circumstances, I have to assume that Snowden was the target - if $RANDOM_DRUGDEALER was the target, Lavabit going to a politician and saying "We've been told to hand over records of one of our 50,000 users" wouldn't tip anyone off.

This is a total fuck-up. The EFF and ACLU can get involved now, but so many mistakes were made early on it's going to be an uphill fight for everything except the free speech issue. In particular, if you're expecting this to end up with a judgement that it was wrong to demand access to Lavabit's data, you're going to be sorely disappointed.

When you say the FBI "asked" for real time metadata, did they have a warrant?

Regardless, the jump from "you're not doing what we ask" to "we get to install a black box on your network and spoof as you, trust us not to abuse this" seems excessive if not absurd as lavabit's core business is centered around privacy. It would be like a safe company being required to issue a key to every safe they've ever made to the FBI because they wouldn't hand over a single purchaser's account information.

if the US gov asked a huge mega-corp to break its whole business model and trust, essentially going out of business (think big auto makers or sony or some huge corp like that) do you think it would happen? would the gov push around a huge company and try to ruin them, just to get some (cough) meta-data?

small guys who can be made to look 'dodgy': yes

big co's who donate to the election campains: certainly not!

"business as usual";( might makes right. time and time again, the larger the government gets, the more power it gets and the more corrupt it gets until its main goal is just to keep itself going along the same trajectory. ethics and fair treatment be damned.

Lavabit wasn't as principled as claimed by Glenn Greenwald et al. They did actually plan (or told the courts and the FBI they would anyway) to release the records relating to $PROBABLY_SNOWDEN to the FBI. At best you can argue they were lying, but how's that showing integrity?

Once they were given a proper warrant, complying is the principled thing to do. That's proper due process. The point is to prevent the government from gaining access to information while skipping said due process. So no, at best I can argue they were telling the truth, and doing the right thing.

Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing. These mistakes made it easy for the FBI to argue that they couldn't trust Lavabit to do what Lavabit was offering to do. Lavabit should have contacted the FBI immediately, made it clear their concerns

Assuming the facts are correct, agreed.

and not made a clearly bad-faith offer to provide something useless to the FBI

I don't think that's what they did. The first offer of providing the information on a monthly basis seems both useful and better targeted than the initial FBI request. Why is this a bad-faith offer?

Notwithstanding the above, the court's refusal to allow Lavabit to talk to politicians et al about the basic principles in the case seems absurd and completely unconstitutional.

Right. The whole thing was the government throwing a fit. "Oh, you want to fight us. We'll up the ante, and ask for something completely unreasonable then.." It was very principled on their part to not fold as a result, and to shut down instead of giving them what they wanted.

1. Non-cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to refuse to cooperate.

2. Bad-faith cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to place limits on the extent of your cooperation, if any

The state can issue warrants for data, but until and unless they successfully do, they are entitled to sweet fuck-all from whoever they are requesting the data from. A court can go ahead and give a warrant for what

Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing.

You shouldn't have to use a lawyer to get justice in a free nation. It shouldn't be possible to use a defendant's naivete as a procedural trap to extort concessions and violate due process. Judges are supposed to be biased in favor of defendants to ensure this doesn't happen. The puppet FISA "judges" are so quick to lick the boots of their real master that they can't be bothered to maintain a believable charade.

If you read the article, they demanded the SSL key since Lavabit did not comply with the earlier order. All the Feds originally wanted was metadata for one user. Lavabit could have provided that, but refused. The prosecutors asked they be held in contempt of court, and then asked for the SSL keys. This is on Lavabit.

Yes, how dare the impudent bastards attempt to protect their customers from illegal surveillance!

Yes, how dare the impudent bastards attempt to protect their customers from illegal surveillance!

The problem is that the law says what the investigators wanted in this case was legal, and it appears that the Supreme Court has previously said was legal. If you want to claim that it was "illegal surveillance," you're going to have to come up with some interesting magic since it apparently was for investigation of an actual specific crime.

It's not magic, it's the rule of law: Per the Constitution, it is the supreme law of the land, and cannot be superseded by anything except a Constitutional Amendment. As no one has, to date, amended the Constitution to nullify the 4th Amendment, any "law" that violates the right of the People to be free from unlawful search and seizure is, in fact, not a legitimate law, no matter how many political appointees scream that it is.

If the government made a law that said it was required for every goyim to kill at least 1 Jew, and the SCOTUS supported it, would you say the murders are legitimate, legal acts?

Well, OK, maybe not you, specifically, but a person of reasonable faculties who has not already proven themselves to be an ardent licker of federal boot.

Lavabit being "in contempt" regarding the first request in no way justifies the second.

This is just more of this sort of post-factum argumentation that is so common everywhere lately. You even see it at the level of the SCOTUS. Some goal is declared supremely important and then the law is distorted to fit that objective rather than to actually honestly examine if that objective is even legal to begin with.

By July 9, Lavabit still hadnâ(TM)t defeated its security for the government, and prosecutors asked for a summons to be served for Lavabit, and founder Ladar Levison, to be held in contempt âoefor its disobedience and resistance to these lawful orders.â

In my humble and non-judgely opinion, the fact that Lavabit would have had to defeat its own security means that the original decision that allowed collection of metadata without a warrant supported by facts (Smith v. Maryland) should not apply to this case and the government should have had to articulate facts that led to reasonable suspicion in order to obtain a warrant to get metadata from Lavabit.

Ah, the NSA lapdog comes in to try and weedle and twist and squirm any way he can to apologize for the NSA.

But no. You can't even do that correctly, can you? Listen, the FBI demanded something. Lavabits said no. The court said yes. Then the FBI came in with an even bigger demand.

A week later, prosecutors upped the ante and obtained the search warrant demanding “all information necessary to decrypt communications sent to or from the Lavabit e-mail account [redacted] including encryption keys and SSL keys.”

"Upping the ante" is pretty synonymous with bullying. They refused the request, and the court order, and then the FBI "ups the ante" and demands complete access to everything? That's bullying flat out. It's abuse of power. Comply with our demands or we'll throw the whole book at you and make you dance.

This is on Lavabit

You mean the blame for this shit? No. No I don't think the blame is on Lavabits. I think the FBI got miffed that their cock wasn't sucked hard enough so they decided to rape a business to death.

Hey, the FBI came back with a warrant. Ok. That's not that bad. It's actually a lot better than this bullshit warrantless "pen register order". That the warrant includes COMPLETE control over ALL communication that your entire business is specifically sold as being secure? That's bad.

Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed took LavaBit back to court, and obtained a court order requiring that LavaBit provide the SSL key, as the fed did not believe that LavaBit would comply with an order for information on a single account. The best part was when LavaBit sent them the SSL key, as a 4 point font printout:-)

In other words, when LavaBit wouldn't provide them information on a single account, the fed escalated to the nuclear option.

Like I said, I don't disagree with how LavaBit handled this. In fact, I think EVERYONE should treat federal 'requests' for information the way that Ladar Levinson has, and greatly admire the stand he has taken. I was simply saying that it was more complicated than the summary made it out to be.

That being said, in my personal opinion the fact that the fed can request envelope information with no probably cause is a travesty. I see it as no different than pulling mail out of my mailbox to see who I write letters to and who writes to me. This should be illegal search and seizure

Stop right there. The fact that they are allowed this without probable cause is already too much.

It is interesting that the prosecutor portrayed this as a pen trap. Courts have ruled that users do not have a reasonable expectation that the numbers they dial on their phone line will remain private (basicaly because they show up on the bill) but that they do have a reasonable expectation that nobody is listening in. That is why this information can be obtained without probable cause. But if Lavabit offered specific guarantees that this information would not be recorded except in the encryted e-mail boxes, then the users had a reasonable expectation of privacy. This might make the use of a pen trap without probable cause illegal.

Actually, it does. The 'expectation of privacy' is not based on a particular entity, but is based on who the information is already disclosed to. For example, you have no expectation of privacy in a park because total strangers can see what you're doing and you know it.

The whole pen register deal was a bit of sophistry in the first place claiming that you already disclosed the number dialed to the phone company. Lavabit ups the ante by specifically agreeing that the headers are your private information and

No. You should have a good reason for telling them "no", then you should tell them "no" with your reason, and get lawyers involved. Pretending to technically comply with a court order while making an obviously obstructive, bad-faith effort is a good way to ensure that things go rapidly downhill for you.

I wish I could agree but I don't. The US government has crushed some fairly small-time players. They have the big players well in control (MS, Google, Facebook), and they aren't going anywhere (too many stakeholders, can't be moved or shut down the same way). This particular skirmish is win-win for the US government -- fewer choices for citizens, more people forced onto the big centralized systems they have full access/control to, proven threats to use against any future outliers.

...when the fact emerge that they were defying [Secret, Unaccountable, Undemocratic] court orders.

Cold Fjords subservient cheerleading to power never ceases to entertain. Obviously the operators of the Cold Fjord account have learned absolutely nothing from history, or are on the wrong side. See: "Means Used by the Nazi Conspirators in Gaining Control of the German State" [nizkor.org]. Quote: "To make certain that cases with political ramifications would be dealt with acceptably and in conformity with Party principles, the Nazis granted designated areas of criminal jurisdiction to the so-called Special Courts (Sondergerhte)."

The FISA courts were created by Congress, the same as any other Federal court besides the Supreme Court. The FISA court is accountable to both its appeal court and the Supreme Court like other Federal Courts, and the Judges can be removed by Congress as can other Judges. In fact, the Judges on the FISA court are ordinary Federal judges that rotate through the FISA court from other Federal courts.

The FISA Court is accountable to no one. The FISA Court meets in secret and only one side is represented, so there is no possibility of appeal for those whose rights are trampled. The FISA Court has denied only 11 of 33,942 requests in its 33 years of operation and the FISA Court of Review has met a total of twice in that time period. The design and operation of the FISA Court provides no path for accountability to the Supreme Court. Even if the telecom companies that were required to provide customer data to the government wanted to appeal, there is no requirement that their arguments are considered (the FISA Court allowed Yahoo! to appeal in 2008 so that the law in question could be ruled okay and a heavily redacted ruling released to make sure no one else bothers to try). No FISA-related case has ever gone to the Supreme Court and it isn't clear how one could.

Congress has no oversight of the judges. Each judge is appointed by the Supreme Court Chief Justice with no oversight or confirmation by anyone else, including Congress. In the 33 years of FISA, we've had three chief justices, all conservative Republicans. John Roberts appointed every single FISA Court judge currently serving.

Your dishonesty regarding FISA is troubling. Either you are ignorant of something you strongly support or you are lying in hopes of deceiving others.

Re.."public will support them when the fact emerge that they were defying court orders."
The public now understands that the totality of the encryption was at risk and not just for 'one' account.
That basic insight is a great fact that has emerged and now its public can be talked about:)

Hmmm... wonder if LavaBit can sue the Justice Department and the FBI for illegally restricting their commerce? IANAL, but damn sure wish I was...

True justice transcends "laws." There are unjust, unfair and unethical laws. Unfortunately, too many people believe that "the law is the law" and it cannot be changed. The civil rights movement wouldn't have (moved) if it weren't for the realization of the contrary (that some laws _should_ be changed).

The header information blanket traces back to an idiotic ruling that the outside of a letter was not protected since everybody can and had to read it to get it there (the USPS digitizes and stores all of them now). The FBI then applied this to encrypted traffic which makes no sense since it's no longer data that anybody but them or there agent can read.

We need clear guidance, which a simple presidential order could give that prohibits all of these sorts of searches.

Protecting *all* of your users or shutting down to avoid betraying one of them has a philosophical elegance about it in my mind. After all, what good is your service if it's basically "we'll protect your data...unless the government tells us they feel like reading yours. Then you're SOL"?

Granted, it's debatable whether that was really the intent, but oh well.

Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed t

It's not a warrant. Email headers are not protected information under the law so all you need is a subpoena. Since they are disclosed to third parties there is no expectation of privacy under current law.

It's the same idea that the outside of the envelope that you give the postman is not protected. Nor is a list of phone numbers that you call.

FBI guy: But Judge, I need to break these fifteen laws and the constitution to catch the bad guys!Judge: Oh, gotta catch the bad guys. Is this where I sign?FBI guy: Yes, thanks. Oh, and can you please nullify this parking ticket for me while you're at it?Judge: Sure thing. Now go get 'em.

FBI: The precedents handed down allow us to demand this.Judge: That sucks... unfortunately you are right.FBI: Tell them to hand over the goods or we'll appeal and you'll get slapped down and you'll still have to do it.Judge: Fine, assholes.Lavabit: We're going to comply in the least cooperative way.Judge: Don't fuck with me, I'm already in a bad mood from Special Agent Dickface over there.Lavabit: NyaahhhJudge: Okay, fine. Which is to say, pay a fine, now.

if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone.

I don't think so. There's a big difference between the legal firepower available to a small service provider like Lavabit and someone like Yahoo or Google -- and handing over the ability to read everything is definitely not something that a simple warrant can legally require. Nor even an NSL.

In fairness, in this case the FBI's original request did ask for just specific metadata about one user. I haven't read it closely enough to understand how the scope was broadened so dramatically, except that I understand that Lavabit refused to comply early on, and then eventually the FBI decided that they didn't trust Lavabit to comply correctly due to Lavabit's obstructionism, and so decided that they just wanted to be able to read all the traffic and extract the bits they needed themselves.

Lavabit, of course, decided to shut down instead. That way there would be no traffic to read.

In all fairness their first request was horseshit. The idea that the metadata of email even encrypted email is not protected is already so outlandish as to be nearly unbelievable. We now know we live in a police state.

This judge is either willingly part of this bullshit or the most naive SOB that ever lived when he believed the FBI would only take the information the warrant allowed. If you give them the ability to get more they will take more.

Go ahead, mod me troll. But given the recent revelations, how can we claim to be any better than even the fucking UN at this point? I've made a complete u-turn on this issue, and it scares the crap out of me that I would have continued to defend the US as the savior and guardian of the open and free internet if it wasn't for a single guy leaking some stuff. And we can't even push something as simple as net-neutrality regulations through without it becoming a horrible political mess.

Fuck this government and its institutions and fuck the people that support it.

The good think about the US is:
The 1st and 4th amendments make what most other countries can do less easy.
The US press and lawyers now know more:)
In other countries cleared bureaucrats or police would set up long term isp logging based on ip/ports/time found via their work laptops at home.
Find, point, click your in the system for years.
Your automated isp logging might get a more senior bureaucrats or police review after many months. Some 'ministers'/'court' staff rushed review year/s later for an e

I'm blowing seven mod points I've already handed out on this story doing this, but meh, who cares. Pointing out someone has no idea what they're talking about is worth it. Sending the most lawyers has nothing to do with legal precedence. Lawyers can't influence legal precedence any more than any other person in the country. I'm not sure why you even care about legal precedence - it's not usually a very controversial subject. It's just how things are.

A court has precedence because courts are set up in a hierarchy by the legislature.

Some types of law have precedence over others, for instance the constitution over statute and statute over regulation.

Of course, they may want to send lawyers because of things called legal precedents. It's something different. Go look it up.

I blew twenty-four mod points, came home from work, crashed my car, paid a thousand dollars, screamed at some people on the street, and made my girlfriend break up with me in order to fix that missing article.

I thought these and similar laws (wiretap, etc) were only allowed to act upon the entities being investigated and for which the warranty was issued. And it sounds like Lavabit tried to keep the scope narrowed to the one person being investigated, but the FBI wanted more. Isn't this over reaching the scope of the warrant and therefore any case developed would be tossed out? IANAL, but I thought the scope limitations were there for a reason. That idea TPB had to buy an island is sounding more and more convincing these days...

Lavabit did not offer an alternative solution, they offered to comply with the ORIGINAL search warrant that asked for just one user after prosecutors upped the ante when Lavabit refused the first search warrant.

FTA:"By this point, Levison was evidently willing to comply with the original order, and modify his code to intercept the metadata on one user. But the government was no longer interested."

UPDATE 7:00pm CT: In a press release published on his Facebook page, Levison confirmed the unsealing and laid out his defense.

“People using my service trusted me to safeguard their online identities and protect their information. I simply could not betray that trust," he said. "If the Obama administration feels compelled to continue violating the privacy rights of the masses just so they can conduct surveillance on the few then he should at least ask Congress for laws providing that authority instead of using the courts to force businesses into secretly becoming complicit in crimes against the American people. http://arstechnica.com/tech-policy/2013/10/lavabit-defied-order-for-snowdens-login-info-then-govt-asked-for-sites-ssl-key/

The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested.

When I was growing up (70s and early 80s), all the US propaganda about how bad the Soviet Union was, how bad East Germany was, in terms of privacy, citizen rights, and being police states.

"Hypocrisy!", in my opinion.

In my opinion laws should protect non-suspect citizen rights, and enforcement agencies (FBI in this case) should be legally required to only target and restrict their levels of privacy breach to only those individuals or organizations of inquiry. They should have no legal authority to make such demands, and if a company or citizen gets such a demand, the FBI should be able to be publicly sued for attempting to exceed their authority.

AND, if the FBI currently is allowed to do such dragnets, the laws should be amended to remove such authority, and be enforced.

It's not limited to just SSL. Any company that holds a copy of your encryption/decryption keys (a public certificate is OK, the matching private key that goes with it is the problem) can be ordered to turn them over. The only safe system is where the keys that secure the system never leave your possession.

For e-mail that means using S/MIME or OpenPGP with a self-signed certificate and a private key you generate yourself. For encrypted documents, the same. The e-mail and documents need to be encrypted on your end before they leave your computer. Be aware that if you're encrypting messages to someone else the security will be controlled by their handling of their keys. You're encrypting using their public key, there's no security implications from disclosure there. However, if the recipient's using a service where the provider has a copy of their private key (used to decrypt messages to them) then messages can potentially be eavesdropped on by outsiders who've compromised the provider and gotten the key. Be aware of this aspect and make sure you know how recipients are handling their own security.

Yes, the above means any and all web-based or hosted services are automatically vulnerable no matter how they're designed. The only secure systems are ones where you, or software running on your computer and that you control, does the encryption and decryption and the private keys are never disclosed to any other party.

Oh BTW, yes that means that public-key certificates issued by a certificate authority are also vulnerable. Not as vulnerable, but if you're depending on a CA to vouch for the validity of the certificate then the government can demand (and have demanded) that the CA turn over their root signing keys. At that point the government can issue themselves a certificate in your name, signing it with the CA's key, and their certificate will be accepted as valid by everyone allowing them to impersonate you. That's no

Basically, the government can force you to do anything it wants, and there's nothing you can do about it. Strange, I remember hearing about some document that spelled out certain limitations on the governments powers, and certain rights that people had, but I must have misremembered.